amuck-landowner

Greenvaluehost hacked, customer details exposed to public including customer photo IDs

Aldryic C'boas

The Pony
db_username = root ... That isn't normal /secure is it?
One thing that means right off the bat is that the GVH kids have zero experience with DB administration.  Allowing rootuser SQL access from anywhere other than inside the same box, and then only for maintenance, is incredibly, fatally stupid.  Right up there with allowing software you can't audit yourself to run as UID 0.

What's really amusing though - now that you have their (hopefully) old password from configuration.php;  if they were stupid enough to run rootSQL, I'm betting that same password will let you into at least one other area of their "secure cluster".
 

tmzVPS-Daniel

Active Member
Verified Provider
We simply use a third party service to load attachments from clients etc and it gets deleted after a week. Anything that is needed that will need to be used in the future is saved locally under a clients account. The less information you keep online the better!

- Daniel :)
 

drmike

100% Tier-1 Gogent
We simply use a third party service to load attachments from clients etc and it gets deleted after a week. Anything that is needed that will need to be used in the future is saved locally under a clients account. The less information you keep online the better!

- Daniel :)
Like I keep saying, LAN is where things are and should be more and more.  Glad to see a company saying this and doing this.

With such attachments and ID docs, no real reason to preserve beyond ehh 90 days... just bad juju to have such perma stored (IDs, passports, card scans, utility bill scans, fingerprints, scans of boobies, etc.).
 

WebSearchingPro

VPS Peddler
Verified Provider
Well from the configuration.php that is floating around, the MySQL server was hosted over on a server in OVH Canada. Its down now though so no telling what the state of security on the box was when the backup was generated.
 

Aldryic C'boas

The Pony
With such attachments and ID docs, no real reason to preserve beyond ehh 90 days... just bad juju to have such perma stored (IDs, passports, card scans, utility bill scans, fingerprints, scans of boobies, etc.).
Ditto.  I do require occasional ID verification for orders that trip certain flags - but I make it clear to the client that it's at-point verification only.  Once I have the account verified, I destroy the submission.  There is never a good justification for storing something that sensitive.
 

Munzy

Active Member
If I am not mistaken, isnt it illegal to have customer data (credit cards, etc.) being passed through a non-encrypted connection. I.e. mysql -> whmcs?
 

DomainBop

Dormant VPSB Pathogen
the MySQL server was hosted over on a server in OVH Canada.
so 25.5ms latency from the WHMCS at RamNode NYC to the database server at BHS...performance must be wonderful...especially when there are network blips between NYC and BHS. 

db_username = root ... That isn't normal /secure is it?
...and this tardness is exactly why I told  Jon on WHT he needs to hire someone like Rack911 to do a forensics exam and setup a security framework and policies for both his sites and his company (and that includes changing his hiring practices which open up a huge security risk).  Given the lack of basic security repeatedly displayed by GVH I'm sure their servers are rooted and have numerous backdoors.

tl;dr if you're a GVH customer your info has probably been compromised since day 1
 

raindog308

vpsBoard Premium Member
Moderator
BTW, the title of this thread is somewhat incorrect.  GVH was not "hacked" in this case.  They just left everyone's info in a publicly-accessible folder.  No Guardians of Peace needed.
 

If I am not mistaken, isnt it illegal to have customer data (credit cards, etc.) being passed through a non-encrypted connection. I.e. mysql -> whmcs?
 
You can encrypt MySQL traffic.  
 

One thing that means right off the bat is that the GVH kids have zero experience with DB administration.  Allowing rootuser SQL access from anywhere other than inside the same box, and then only for maintenance, is incredibly, fatally stupid.
 
Indeed, one of the things mysql_secure_installation does is turn off non-local root access. Who sets up MySQL without taking 10 seconds to run that script?

It really should be turned off by default.
 

Right up there with allowing software you can't audit yourself to run as UID 0.
Unfortunately, virtually everyone does just this - loading binary blobs of vendor firmware into their kernels. But I'm being nitpicky and Christmas-hangovery.
 

Munzy

Active Member
BTW, the title of this thread is somewhat incorrect.  GVH was not "hacked" in this case.  They just left everyone's info in a publicly-accessible folder.  No Guardians of Peace needed.


You can encrypt MySQL traffic.  


Indeed, one of the things mysql_secure_installation does is turn off non-local root access. Who sets up MySQL without taking 10 seconds to run that script?

It really should be turned off by default.

Unfortunately, virtually everyone does just this - loading binary blobs of vendor firmware into their kernels. But I'm being nitpicky and Christmas-hangovery.
I mean, I thought it was illegal to pass backend db queries over the internet unencryted if you were a sales site.
 

raindog308

vpsBoard Premium Member
Moderator
I mean, I thought it was illegal to pass backend db queries over the internet unencryted if you were a sales site.
I'm going to guess that if GVH couldn't handle 'touch index.html' to stop someone slurping down a .zip of drivers licenses, they probably didn't setup OpenSSL for their MySQL  :lol:

And btw...hosting in OVH?  WTF?  Isn't GVH in the business of renting VPSes and servers?
 

Aldryic C'boas

The Pony
And btw...hosting in OVH?  WTF?  Isn't GVH in the business of renting VPSes and servers?
Well, considering the punishing lack of efficiency both GVH and their upstream showed at mitigating attacks, it's not all that surprising they tried to use OVH just for the 'protection'.
 

drmike

100% Tier-1 Gogent
If I am not mistaken, isnt it illegal to have customer data (credit cards, etc.) being passed through a non-encrypted connection. I.e. mysql -> whmcs?

I don't know if it's illegal....  It's definitely not up to snuff for handling things and any sort of real world compliance though.  Compliance, oh?   No one in kiddie land is compliant with anything, other than 'tardation.   

What it is, is well, stupid - the unencrypted over the public net MySQL talking...

I don't use SSL with MySQL remote (which I try to avoid like the dickens).. But that data I move to MySQL, when I have to is in an encrypted tunnel, so same general idea.

As usual, I feel for people like this....

A person with a real business, small business... Who didn't buy from GVH, but bought from a less in public bad image company...  From a GVH whitelabel reseller let us say....  Where we can excuse utterly flawed purchasing to some extent.  I feel for folks who have their IDs, passports, etc. in public.  Yeah it could be worse, and for all we know, it might be / might have been prior.

Security is an afterthought in most of these chop shop hosting companies.  Just a matter of time before the lawyers come see the money rolling around and start putting idiots out of business.  When it happens, I'll be the first to congratulate them.

It is time to rip up cheap half cocked wannabe companies.  I called many on their distortions and marketing lies, including GVH.  Next year, it gets more real.
 

MattKC

New Member
The sad part, is he will just go on (as he has) posting new offers and suckering more people only looking at $. A situation like this begs a legal intervention, but with $10-30/year customers overloading the nodes, few if any will bother. Hopefully if any do experience identity theft or card usage they will report to their states attorney General...you know he hasn't reported it. If he thought the last breach was the end of GVH, he's seen nothing if authorities were to get involved in this gross negligence.
 

MannDude

Just a dude
vpsBoard Founder
Moderator
The sad part, is he will just go on (as he has) posting new offers and suckering more people only looking at $. A situation like this begs a legal intervention, but with $10-30/year customers overloading the nodes, few if any will bother. Hopefully if any do experience identity theft or card usage they will report to their states attorney General...you know he hasn't reported it. If he thought the last breach was the end of GVH, he's seen nothing if authorities were to get involved in this gross negligence.
As mentioned previously, perhaps in a different thread, I am willing to bet a large portion of their customer base would be those from non-native English speaking countries. They're less likely to read a lot of reviews, or to fully understand them (depending on their grasp of the language they're written in). With other parts of the world be poorer in comparison to other more developed areas, reviews become much less important as price becomes the most important factor.

All Jonny has to do is keep offering low prices and he'll continue to sucker people into buying, regardless if the product is good or bad or secure or risky.
 
Last edited by a moderator:

splitice

Just a little bit crazy...
Verified Provider
Anyone know if they at-least notified their customerbase of the breach? i.e mass email?
 

WebSearchingPro

VPS Peddler
Verified Provider
If you would've read page one you would have seen :p 
Just because they made a passive post on their website's announcement page doesn't mean they will actively email affected clients. :)

In this case, they probably said they'll email affected clients to get out of emailing anyone. People will just assume they are unaffected if they never get an email. See what they did there?
 

Amitz

New Member
In this thread, somebody previously believed as dead and called 'Pantoric_Chad', claims that Jon has a severe problem with alcohol:

http://lowendtalk.com/discussion/39611/how-a-person-makes-more-than-1000-and-makes-a-run-for-it-drama-alert/p1


Excerpt:

During, the months, dealing with GVH, and its abusers, and Jon, getting drunk messaging me on Skype asking me about mixed drinks, yes, because I am also a bartender I began to start having concern, about my VPS's, and my clients, because I encountered a few times where when Jon didn't get his way, he would threaten my services. I purchased my own nodes from GVH to move my VPS's to so I didn't have to deal with a drunken 16 year old who when he didn't get his way, it put my clients at risk. I threatened to leave GVH and stop my support a few times, but Jon begged me to stay. He lost a few great support people along the way.
Would explain some things even though the whole thread is completely hilarious and you have to be drunk or stoned yourself to believe it.
 
Last edited by a moderator:

Geek

Technolojesus
Verified Provider
Last edited by a moderator:

DomainBop

Dormant VPSB Pathogen
I haven't got an account over there but I'd love to read the OP's accusations. Can you pastebin it or something?
Hello, guys!

Its now, time for myself Chad Hotard owner of Pantoric to state my side of the story.

First off, to clear things up, I hired @BharatB less than a month ago, with the agreement per his request I provide him a $50/payment every 2 weeks. Our agreement, was held after @BharatB providing support his first 2 weeks I paid him his requested amount of $50. When coming upon his next 2 weeks payment, he requested that I use a portion of his payment to purchase a cPanel license for his friend. As he requested I did. The remaining amount, was due to be paid, a few days later in which was agreed by myself and @BharatB payment would be paid once a few clients paid their monthly dues. Then thats when this all happened. So of course, nothing was paid beyond this point.

Now, @BharatB before you assume things at take in information and roll with it, you should ask yourself? Should I listen to a 16 year old kid whom has the worst reputation in the industry? Should you first take in facts, attempt to contact myself and see what really is taking place? Remember being part of Pantoric, you should be on this side of the line, and support Pantoric before trying to through it under the bus, or make it look like I am the bad guy behind all of this.

A few months ago, I ran across the company GreenValueHost, which offered cheap prices and even after speaking with the owner Jonny, was offered other discounts. At this time I did not do my research about the company, or else I would not have dealt with it.

I launched my first VPS, with offered 24 cores, 8GB Ram, etc on SSD. Here is the screenshot of the service line which is listed under my client portal as cloud.serversvast.com formally renamed beta.serversvast.com : http://prntscr.com/5lcdeh I paid $28.79/month for this VPS. After testing its service for a few weeks I purchased another VPS with the same specs, You will see the invoices here http://prntscr.com/5lcj6m gamma.serversvast.com formally renamed atlp1.serversvast.com : http://prntscr.com/5lcdmg I paid for both servers without doubt.

After purchasing the second VPS, I began to start having major issues with the network, and loads of the servers. This was due to abuse by other clients on the node I was provisioned on. After several support ticket, many not resolved after several days. I began doing my research to find, clients reviews having the same issues. This is when I attempted to contact Jonny and speak to him hand and hand about getting the issues I was having resolved. I was provided access to the nodes he provided me. I found all the abusers and suspended their VPS after confirmation to do so from Jonny. My servers began to run flawlessly again.

GVH then announced its VPS Reseller services which I was 100% interested in. GVH offered major discounts on this service which, even then I contacted Jonny and he offered double the specs offered for 2x the monthly offer amount. For example 500GB disks was offered I got 1TB disks resources. I paid $49.14/month for VR-Enterprise as you can see the invoice here http://prntscr.com/5lccpz

When I started offering VPS's to my clients, they began to complain about countless issues which, I lost a few clients over this, because again. I couldn't get the support from GVH to resolve the issues.

I then came back to Jonny and offered my outbound support to help him resolve whatever issues their client's as well as myself was having. He gave me access to his WHMCS (support desk) as well, as nodes, SolusVM admin access, as well as access to the HVH (hudsonvalleyhost) support desk the middle guy between GVH and ColoCrossing where GVH received their services. I began tackling all the abuses which caused issues for its clients and my clients. With great appreciation Jonny, offered to make all of my services free with the agreement I continue supporting GVH. Of course I took on the offer, why wouldn't I? So Jonny made my 2 current VPSs as well as my VPS Reseller free. You will see that in this screenshot. http://prntscr.com/5lcnyw If you noticed after all that stated happened GVH formally renamed the VR-Enteprise service under my account to Pure SSD Unmanaged VPS Hosting - VS-Standard I guess to make it seem more like I was stealing VPS's as @BharatB was stating. Each VPS I created, either for Pantoric's shared reseller clients or VPS clients it was created under the VPS Reseller I once paid for, that was offered to me free from Jonny.

Each, month the only issues I would have with my VPSs was when GVH failed to paid their invoice with HVH and the automated system would suspend the node. After myself or another support agent would ticket to HVH they would unsuspend the node, sometimes taking several hours. However everything else was great until around the same time each month. I sometimes found this hard to understand, because of the amount of money GVH was taking in. My services was free so what did I have to complain about.

During, the months, dealing with GVH, and its abusers, and Jon, getting drunk messaging me on Skype asking me about mixed drinks, yes, because I am also a bartender I began to start having concern, about my VPS's, and my clients, because I encountered a few times where when Jon didn't get his way, he would threaten my services. I purchased my own nodes from GVH to move my VPS's to so I didn't have to deal with a drunken 16 year old who when he didn't get his way, it put my clients at risk. I threatened to leave GVH and stop my support a few times, but Jon begged me to stay. He lost a few great support people along the way.

About a month ago, GVH launched a new node in Amsterdam. I created a VPS under my Reseller panel which housed cPanel shared reseller clients. This VPS was hosted on the node for a month before adding clients and offering the service to make sure there was no issues. On Cyber Monday I offered a discounted offer for shared reseller hosting to my clients, in which didn't come anywhere close to the amount @BharatB stated we received as it was only about 20 accounts. At the time of its deletion by Jonny, owner of GVH it hosted around 160 websites. I began to see issues with the server, so I contacted Jonny and informed that the loads was over 100+ and it was affecting my VPS on the node. Jonny was concerned that about the VPS on this node because of the cost. I told him at that point I would help pay whichever he needed my to pay to keep it because it housed important clients. He told me just do not abuse it, because of the monthly costs to operate it. I agreed, he provided my login details for SSH to find the root cause of the high loads. I found there was a bitcoin miner abusing its resources. The VPS was suspended and Jon notified. With his thanks, we went about our ways.

Recently, I began having issues with beta.serversvast.com the first VPS I purchased from GVH, because of disk space reaching its limit. My cPanel stopped to protect any disk corruption. I then removed old backups and freed up space which caused it to work again. I notified Jon about the node reaching its limit and I told him then, I would probably ned to move the VPS, so I wouldn't have any issues again. This node, was only 1TB SSD. He told me no, that it would be fine. To keep the VPS there. So, I did.

The day, the deletion of ams1.sr-servers.com the VPS that was on the most recently added node in Amsterdam. Here is what happen.

I began to have issues again with beta.serversvast.com, again due to disk space. So I contacted Jon to get node details so I can get it fixed. The node only had a few GBs left which was causing the issue. Jon come back with a reply as if, he didn't know anything about any of my VPSs, and immediately deleted my VPS ams1.sr-servers.com out of anger. Now, remember the VPS that was having the issues was my very first VPS, that I purchased from GVH that Jon made free. I didn't mind paying for any of my services. He suspended all of My VPS's at this time, and told me he would invoice me for the services. Which I didn't mind, I told him to invoice me.

I am sure the reason behind all of this, was because Jon didn't need my support anymore, because he hired a team of outbound support indians to help him. So, why would it matter anymore, if I was there? He didn't have to beg me to stay and assist anymore. Even, other support agents that has been there supporting GVH through everything was upset and even left because of the team of indians that was hired. The team he hired only replied to tickets knowledge that the ticket was received, but would not resolve the issue. I just feel bad for anyone who has to deal with GVH.

When Jon, deleted my VPS, I lost control. I just wanted to crawl in a ball and die, I couldn't face my clients. I mean who wouldn't feel this same way? After working as hard as I did to build my client database and my business and it get deleted before your very eyes. Only because of a 16 year old kid who is trying to run a hosting business got upset. This is something a lot of GVH clients faced. I felt bad for a lot of GVH clients.

After seeing my client’s data, my website data, everything gone, I didn’t know how to face the fire with my clients. I shut down my computer and ran. I am sure something anyone would do after the same thing would happen to them.

After a few hours of crying, and freaking out what I would do next. My only reaction was I needed to gain the funds back from the 2 dedicated servers I just purchased from GVH, cause I knew, I would be facing refunds.

When, I done this I was of course informed by Jon, that all of my VPSs was removed. I mean I lost the VPS that housed my most recent top paid clients. I didn’t know what else to lose.

So, after I filed the dispute I logged off of my computer for the final time.

I got really sick. I am sure it was, because of my nerves. I logged into paypal a few times, responding to claims, and granting full refunds to any client who purchased services the past 30 days. So, as far as taking peoples money, @BharatB you should not assume things before you know the true facts. Here is a screen of some of the refunds provided to most recent clients http://prntscr.com/5ld5qp so taking money? Very doubtful!

During my absence, I attempted to login to my Skype account to find I was unable to login due to the wrong login details. I knew I was supplying the correct details. I followed the forgot your password options to recover my account. However, I never got the password recover email, to the email I knew I provided when I created my Skype account. I just knew someone gained access to my account.

After contacting a few clients and another provider I was informed that someone was on my Skype account claiming my death. @BharatB took this and ran with it. Rather than @BharatB attempting to contact me via Facebook, or my personal email, which he clearly knew. He assumed this was true. He stated that he even looked on my Facebook to see that there was not even a post claiming my death. He even contact friends and family off my Facebook list and questioned my death with them, of course they told him I was not dead. Why wouldn't he message me directly? I still don't know. So, that should raise a red flag right there, right? Yet, when I look to access Pantoric.com I see that it now redirects to his new company website, he just created. So, I login to register.com where I have my domain registered and @BharatB changed the domain contact details to his own person details and took ownership of my domain pantoric.com. Even upgraded to the pro-services. Even if I did die, due to whatever reason. You have no rights to my possessions, this is something my family would control. So, I ask you why would you even do this? Which I do have the logs saved, and emails saved where it shows the details of it being changed to your personal details.

I am still yet to access my Skype account, so if anyone attempts to contact me there, I am not the person in control. I suggest you block that account ASAP.

So, this explains what truly happen to Pantoric. I didn’t jump ships, and run away with money. My temporary absence was because I was sick to my stomach, and I didn’t know how to face this. My services was deleted by Jon, at GVH, because he got PO’ed. I wouldn’t doubt his personally swing was due to him drinking again.

Because he was not the little dude that I knew.

As, Pantoric. I am truly sorry about the data that was deleted by Jon, I can only blame myself for not moving the data before this was to even come up.

Pantoric is not gone, I am not going to let some 16 year old kid, stop my venture.

I am in the process of finding a provider to supply services for my business. The former clients, of Pantoric I will provide services once the provider is found. I will be sure this provider is 100% reliable and not ran by a child. I will be adding contact details, and other details on the pantoric.com domain. I apologize about the data lost, this is something you will have to contact GVH for. There is not much more I could do, until servers or provisioned.

We will be proving honorary services for those clients who has lost their services due to this.

To conclude, I am in talks with a legal advisor about data lost, from clients, and the data Pantoric has lost by GVH and its actions.

I hope this clears up things, makes sense, and puts this to rest.
 
Last edited by a moderator:
Top
amuck-landowner